Sidenote: this procedure is currently only available in Dutch.

What is included in the NIS2 incident reporting procedure?

The procedure covers the entire process: from the first sign that something is wrong, through classification (is this a significant incident or not), external reporting to your sectoral response team (CSIRT) and the competent supervisory authority, to the internal evaluation after the incident has been resolved. Each step specifies who is responsible, so you don't have to figure that out during an actual incident.

What is a significant incident under NIS2?

Not every disruption requires reporting. An incident is significant if it causes, or is likely to cause, a serious disruption of your services or financial damage to your own organization. It can also involve an incident that causes, or is likely to cause, significant material or non-material damage to other organizations or individuals. The exact thresholds vary by sector. For managed service providers and managed security service providers (MSPs and MSSPs), these have already been defined in concrete figures: an incident is considered significant if, for example, a service is completely unavailable for more than 30 minutes, or if availability is limited for more than 5% of EU users for more than an hour.

The three NIS2 reporting deadlines in brief

From the moment your organization becomes aware of a significant incident, three fixed deadlines apply: 24 hours for an early warning, 72 hours for an initial assessment of the severity and impact, and one month for the final report. All these reports go to the same address: your sectoral CSIRT and the supervisory authority responsible for your sector. If you want to go through the deadlines in detail, including exactly what must be in each report and the consequences of missing a deadline, read the article on reporting deadlines.

Who reports to the CSIRT and who is on the incident response team?

The report itself goes to your sectoral CSIRT, which supports you in the resolution process, and to the competent supervisory authority. Within your own organization, it usually takes more than one person to get this done on time: someone to determine that it is a significant incident, someone to actually submit the report, an incident response team to handle the technical resolution, and someone to document what happened and what was learned afterward. The incident reporting procedure assigns these roles so that everyone knows what is expected of them in advance.

What can you do about it now?

1. You must register your organization in advance via MijnNCSC. This requires eHerkenning at level EH2+ plus authorization, which is not something you can arrange during an incident.
2. Determine who within your organization is authorized to decide that an event is a significant incident, as that moment starts the clock for all three deadlines.
3. Download the incident reporting procedure and walk through it with your team before you have to rely on it during a real incident.

This way, when you trip, you won't have to look for the route, because you'll already have it with you.

Want to know more about NIS2 and the Cyber Security Act?

Do you want to know if your organization falls under the Cyber Security Act and what else is expected of you? Schedule a no-obligation, free consultation.